Show Contents / Index / Search

Configuring Ciphers and MACs

The client and server support the same keywords for configuring ciphers and MACs. Configure client keywords in ssh2_config. Configure server keywords in sshd2_config.

Keyword

Values

Ciphers

Allowed values are `aes128-cbc', `blowfish-cbc', `arcfour', `arcfour128', `arcfour256', `aes192-cbc', `aes256-cbc', `cast128-cbc', and `3des-cbc'. You can also set this value to `none'. When `none' is the agreed on cipher, data is not encrypted. Note that this method provides no confidentiality protection, and is not recommended.

The following values are provided for convenience: `aes' (which combines `aes128-cbc', `aes192-cbc', and `aes256-cbc'), `blowfish' (equivalent to `blowfish-cbc'), `cast' (equivalent to `cast128-cbc'), `3des' (equivalent to `3des-cbc'), `Any' or `AnyStd' (all available ciphers plus `none'), and `AnyCipher' or `AnyStdCipher' (all available ciphers).

The default is `AnyStdCipher'.

MACs

 

Allowed values are `hmac-sha1', `hmac-sha1-96', `hmac-md5', `hmac-md5-96'; and `hmac-ripemd160'. Use `AnyMac' to support all of these. Use `AnyStdMac' to support `hmac-sha1', `hmac-sha1-96', `hmac-md5', and `hmac-md5-96'. Additional options are `none', `any' (equivalent to AnyMac plus `none'), and `AnyStd' (equivalent to `AnyStdMac' plus `none'). Multiple MACs can also be specified as a comma-separated list. When `none' is the agreed on MAC, no message authentication code is used. Because this provides no data integrity protection, options that include `none' are not recommended.

 

Ciphers can also be defined on the ssh, scp, and sftp command line using -c. For example:

ssh -c blowfish-cbc joe@remote.com

MACs can also be defined on the ssh and sftp command line using -m. For example:

sftp -m hmac-md5 joe@remote.com

Related Topics

Encryption

Data Integrity

Client Configuration Files

Server Configuration Files